Another small tidbit.
First (this is probably already known by some, but for others here you are)
NDRV = For the OS. Has nothing to do with booting the OS. Now that's not to say they aren't used early on with the OS start up, but not for booting. (example is graphics drivers. The machine boots fine with out them, but once the OS is up a bit it switches to using the NDRV drivers.
FCODE Drivers = Needed for the device to participate in boot. This is the troublesome part of the xserve at the moment.
FCODE drivers must be stored in the devices ROM. NDRV may or may not be in the ROM of the device. If they are they are usually the ones listed with the appl in the name and have like OSX OR OS9 in the name or something. The FCODE drivers you don't really see exactly.
Now in my last post I noted the trampoline knows about the ATA controllers Apple used, but it doesn't know about the Kiwi because it was never updated to care about it. So the combination of knowledge of the ATA controller and the FCODE on the device, the trampoline code can set up the device so that OS 9 is happy to use it for booting and such.
Now comes the fun part. Getting the FCODE driver. As noted above that driver would be in the expansion ROM of the controller. So we need to dump that and analyze it and then we will be moving forward. Now how do we get that FCODE you ask?
http://www.fenestrated.net/~macman/mirrors/Apple%20Technotes%20(As%20of%202002)/tn/tn2000.htmlHere is the Apple tech note outline how to dump the expansion rom from a device.
So now this is all fine and good, but what good is it? Well to help make more sense of it, it would be better in say C or some other language. Well again Apple to the rescue. In the open source files for OS X there is the bootx project. (Yes I considered modifying that to boot 9, but it does not do enough hardware initialization so it's kind of useless) In the bootx project files there is a sub project. This sub project actually is an FCODE to C tool. How cool. It looks like you just pass it a ROM image and it gives you C code. I think that is pretty cool.
Now reality becomes a different beast here so we'll see if this actually works.
The other cool thing is this.
http://www.fenestrated.net/~macman/mirrors/Apple%20Technotes%20(As%20of%202002)/tn/tn2001.htmlWays to work with forth code from open firmware and being able to read it from the drive and execute it from the drive. Why is this awesome? Well it give me a new approach to the early boot issues. The current method of attack is to reverse engineer (disassemble and make sense out of a bunch of assembly. Doable, but a pain) the trampoline code. Or now my new idea. Do sort of like GRUB does in linux with a 2.5 stage boot loader.
Essentially we can write a program that does just enough to initialize the Kiwi controller enough, load it through the boot script in the ROM image, run it then continue on and execute the trampoline code.
Alright enough thinking out loud.